Cloudflare has announced an expansion of its web application firewall (WAF) by introducing full transaction detection and response rules, according to Cloudflare. This capability evaluates each incoming HTTP request alongside its corresponding origin response to determine if an exploitation attempt succeeded. Traditional request inspection often struggles with ambiguous traffic, forcing defenders to balance between aggressive signature matching that risks false positives and permissive rules that let attacks pass. By correlating request parameters with response data, security controls can establish the actual impact of an attack.
Understanding Full Transaction Detection
Modern threat actors, including automated AI agents, frequently chain vulnerabilities, credentials, and permissions while adapting payloads based on application feedback. Standard request inspection alone cannot definitively establish whether a suspicious input resulted in a successful compromise or an application error.
For example, during a path traversal attempt targeting a file download parameter, a traditional WAF evaluates the URI path and arguments before the origin processes them. While this can stop known malicious patterns, it cannot determine whether the backend application would actually expose a sensitive file or properly sanitize the input. Full transaction inspection solves this visibility gap by analyzing the origin’s reply. If a suspicious request is followed by a 200 OK status containing database configuration strings or private keys, the system generates high-confidence evidence of an active compromise.
New Platform Fields and Rules
To support these workflows, the platform introduces specific fields accessible in response custom rules and managed detections:
cf.waf.signature.response.confidence: Provides confidence values associated with matching signatures.cf.waf.signature.response.categories: Categorizes matching signatures to assist analysts during triage.cf.waf.signature.response.ref: Supplies signature reference IDs for correlation and reporting.
Separating detection from mitigation allows security teams to inspect detection metadata in Security Analytics before enforcing strict blocking policies. The initial managed protections utilizing this engine focus on exploit confirmation for high-profile flaws, including recent components such as php2shell.
Actionable Recommendations
Security professionals operating web applications behind this architecture should prioritize the following steps:
- Enable Managed Protections: Verify that default Cloudflare-managed rules utilizing full transaction detection are active across all application environments.
- Audit Security Analytics: Review detection logs and confidence metrics to identify endpoints frequently targeted by probing or exploitation attempts.
- Implement Custom Response Rules: Design tailored policies that leverage response categories to intercept sensitive data before it reaches unauthorized requesters.
Related: Cloudflare Zero Wire: New Threat Intelligence Feed for CVEs, Metabase Zero-Day SQL Vulnerability Threatens Analytics Platforms